Privacy Policy

Renderei Martin GmbH
Steina 9 A
94086 Bad Griesbach im Rottal
Germany

Email: hey@infectrisk.com

InfectRisk was built from the ground up on the principle of Privacy by Design. The app collects, stores, and processes your profile and health data exclusively on your device. This data is never transmitted to us or any third party; only a device backup that you turned on yourself can contain it (see section 10).

• No tracking of your identity
• Only anonymous usage statistics, with no link to any person (see section 7)
• Your profile and health data stay on your device
• No registration or account creation required
• No data shared with third parties

There are two exceptions. After installation, the Android app sends a pseudonymous device value to our server so that the free trial applies only once per device (see section 14). And if you voluntarily enter your email address on the website to get a wave alert, we store that address until you unsubscribe (see section 13).

The app processes the following data that you provide during setup:

• Birth month and year: Used to calculate your age and your personal risk profile
• Pre-existing conditions yes/no (optional): Used to adjust your risk score
• Description of your pre-existing conditions (optional, free text): Only as your own note; it is not used in the calculation
• Chosen country: Used to show the matching infection data

The app stores this data exclusively on your device; it is not transmitted to us. We have no access to this data. Section 10 explains whether it ends up in a device backup.

The app retrieves publicly available, aggregated surveillance data. It fetches this data directly from the following institutions:

• Robert Koch Institute (RKI), Germany, including AMELAG wastewater monitoring and GrippeWeb
• European Centre for Disease Prevention and Control (ECDC)
• Centers for Disease Control and Prevention (CDC), USA
• UK Health Security Agency (UKHSA)
• Federal Office of Public Health (FOPH/BAG), Switzerland
• World Health Organization (WHO), FluMart

The RKI and ECDC files are hosted on GitHub (raw.githubusercontent.com, GitHub, Inc., USA) and are loaded from there. This data does not contain any personal information; it consists of aggregated epidemiological statistics. The app sends no information about you. As with any request on the internet, the respective servers see your IP address for technical reasons.

For outbreak news, the iPhone and Android apps also call our server at infektrisiko.de (/api/outbreaks): a list of current outbreaks with news items and short summaries. When you open an outbreak whose summary the app has not cached yet, it sends the identifier of that outbreak, the app’s language and the type of summary. Nothing else is sent. Like every request to our server, the request stays in Cloudflare’s technical log for 7 days (see section 12).

The news items come from Google News. When you tap an item in the iPhone app, the app calls news.google.com directly from your device to find the address of the original article; Google sees your IP address for technical reasons. The Android app opens such links in your browser and does not connect to Google News itself.

The app can send local notifications (e.g., when your risk level changes or weekly summaries). These are generated and processed entirely on your device. No push notification server is used. We do not receive a device token and have no ability to send you messages through the app.

This covers the notifications sent by the app. You only receive email notifications if you explicitly sign up for them on this website (see section 13).

The widget displays your current risk level. All data is calculated and stored locally. No data is transmitted to third parties.

The iPhone app uses TelemetryDeck (TelemetryDeck GmbH, Berlin, hosted in the EU) to collect anonymous usage statistics, such as which features are used and how often. As an identifier, TelemetryDeck turns a system device identifier (identifierForVendor) into a salted hash on your device and hashes it a second time on its server; the device identifier itself is not transmitted, and IP addresses are not stored. Your profile and health data (birth month and year, pre-existing conditions, risk values) are never transmitted. The Android app contains no statistics or analytics tool.

We also measure whether our ads on Apple Ads work. When the trial starts, iOS creates an attribution token (AdServices) that the app sends to Apple (api-adservices.apple.com). Apple answers whether the install came from an ad. Of that answer the app keeps only this yes/no value and the campaign, ad group and keyword ID of the ad, stores them on your device and does not ask again. These values are sent to TelemetryDeck as an event when the trial starts and with the first purchase (together with the product bought). We neither store nor send the country, click date or any other details from Apple’s answer.

The legal basis for both is our legitimate interest under Art. 6(1)(f) GDPR in improving the app and measuring the success of our advertising. We do not include any third-party advertising networks or crash reporting services. More information: telemetrydeck.com/privacy

This website and the app do not use cookies.

The app is downloaded via the Apple App Store (iPhone) and via Google Play (Android). Apple Inc. and Google Ireland Limited, respectively, are responsible for data processing in connection with their store.

In-app purchases are handled by Apple and Google as payment processors. You enter your payment details with them, not in the app, and we never receive them. The app only learns from the store whether a purchase exists.

We recommend reading the stores’ privacy policies: apple.com/legal/privacy and policies.google.com/privacy

The information you enter (birth month and year, pre-existing conditions and their description) may be considered health-related data under the GDPR. This data is:

• Processed and stored by the app only on your device
• Never transmitted to us
• Removed from your device when you delete the app

If you have turned on your operating system’s device backup, the system includes this data in your own backup. On Android, the app settings including your profile are part of the Android backup in your Google account and are carried over when you move to a new device; Google stores the backup encrypted. On iPhone, the profile is part of your iCloud backup or a backup on your computer. We have no access to these backups. The data in them is deleted when you delete the backup or when Google or Apple replaces it; deleting the app alone does not remove it there.

Since processing takes place exclusively on your device and in your own backup and no data is transmitted to us, Renderei Martin GmbH is not a data controller for the processing of this data within the meaning of the GDPR.

We do not store your profile and health data from the app, so we cannot provide information about it: it exists only on your device and, if applicable, in your own device backup. You can delete it at any time by removing the app from your device and, if there is one, deleting the backup (see section 10).

For the trial entry of the Android app you have the right of access and erasure and the right to object to the processing. Section 14 explains how.

If you signed up for the email notifications on this website, we store your address and the details listed in section 13. For that data you have the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to withdraw your consent at any time. The unsubscribe link in every mail deletes the record immediately and completely, or you can simply write to us.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de.

If you have any questions about data protection, please contact us at: hey@infectrisk.com

This website (infectrisk.com) does not use cookies. It runs on Cloudflare Workers (Cloudflare, Inc., USA). Data we store, for example for the email notifications (section 13) and the Android app’s free trial (section 14), lives in a Cloudflare D1 database operated in Western Europe. The app’s requests to our server run through the same setup (sections 4 and 14).

With every request, Cloudflare processes technically necessary data such as your IP address. Cloudflare also stores a technical log for every request (Workers Logs) with the request data, such as the address, the time and the headers sent; it may contain your IP address. We use these logs for troubleshooting and to protect against abuse, and Cloudflare deletes them after 7 days. The legal basis is our legitimate interest in secure and working operation (Art. 6(1)(f) GDPR).

For more information: cloudflare.com/privacypolicy

Next to it we run a counter of our own, and it uses no cookies. It processes the page view, the referring site, a country, a device type, a browser, an operating system and the campaign parameters in the address bar. Visitors are counted only as a hash of IP address and browser description that changes every day; the IP address itself is not stored. The counter runs on Cloudflare Workers and a Cloudflare D1 database in the EU region (Cloudflare, Inc., USA). Do Not Track and Global Privacy Control are respected: if your browser sends either one, nothing is counted.

On the data pages of this website you can voluntarily sign up for an email notification. On the German flu, COVID and RSV pages you get at most one email per pathogen and season (September to August), as soon as the level of that pathogen in Germany goes up. On the other country pages you get one email, once, as soon as the infection level in the country you picked goes up. We use your details only for this one email and the confirmation email before it. The form is optional, the pages work in full without it.

All we store is:

• your email address
• the country and, for the email about a pathogen, the pathogen (flu, COVID or RSV)
• the page and the language you signed up from
• the time of the signup and of the confirmation, that is, of your consent
• whether, and for which season, we sent you the email

No account, no newsletter, nothing else. To protect against abuse we also store a shortened hash of your IP address for one hour when you submit the form. It serves only to limit the number of signups per hour and is deleted automatically afterwards. For the same reason we count, for 24 hours and under a hash of your address, how many confirmation emails went to it.

Signup runs as a double opt-in: after you submit the form you receive a confirmation mail. Your signup only becomes active once you click the link inside it. Without that confirmation we send you no notification, and the provisional record expires by itself.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time: every mail carries an unsubscribe link (/api/alerts/unsubscribe), and one click on it deletes your record, address included, completely. Until you unsubscribe, the record stays stored. After you unsubscribe, an unsubscribe block is kept for 48 hours that holds only a hash of your address, not the address itself, so nobody can sign you up again in that time. Under the same hash, again without the address, we note that the email was sent, so it never arrives twice: for the email about a pathogen until the season ends (at most 400 days), for the one-time country email permanently.

We use Resend (Resend Inc.) as a processor for delivery. Processing takes place in the EU region eu-west-1, the sender address is alerts@infectrisk.com. Beyond that we do not share your address and we do not sell it. Our mails contain no tracking pixel: we measure neither opens nor clicks.

The Android app offers a free trial of 7 days. So that it does not start over after a reinstall, the app asks our server at infektrisiko.de when this device was first seen. This happens when the app starts, until the server has answered once, and never again after that. The iPhone app does not need this: it keeps the trial start only in your device’s Keychain and sends nothing to us for it.

The only thing sent is a hash. On your device, the app turns the Android device identifier (ANDROID_ID) together with a fixed app key into a 64-character value using SHA-256 and transmits only that value, encrypted over HTTPS. The device identifier cannot be calculated back from this value, and because Android assigns a different identifier for every app developer, it cannot be used to recognise the device across other apps. It is still a pseudonymous device value and therefore personal data under the GDPR.

All we store is this hash and the time it first arrived. No name, no email address, no account, no IP address. As with every request, our hosting provider Cloudflare processes your IP address for technical reasons, and its technical log may contain it for 7 days (see section 12); it is not stored together with the hash. The entry lives in a Cloudflare D1 database operated in Western Europe (Cloudflare, Inc., USA). It is never extended and is deleted automatically no later than 400 days after the first request.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in granting the free trial only once per device and preventing abuse. Because only a hash and a date are stored, no profile is built and we do not link the entry to any person, we consider that your interests do not override ours.

You can object to this processing at any time and ask for the entry to be deleted. Write to hey@infectrisk.com with the subject “Delete trial entry” and say that it concerns the Android app. Because we store nothing besides the hash, we can only find the entry if you send us your device’s hash (Art. 11(2) GDPR). We then delete the entry and confirm this to you by email.

We reserve the right to update this privacy policy as needed to reflect changes in the law or changes to the app. The current version is always available on this page.